diff --git a/.dockerignore b/.dockerignore
index 0a93110..e316253 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,5 @@
 *
+!bin/install_nim.sh
 !bin/run.sh
 !src/runner.nim
 !src/unittest_json.nim
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..9f1967c
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,14 @@
+name: shellcheck
+
+on: [push, pull_request, workflow_dispatch]
+
+jobs:
+  shellcheck:
+    name: Run shellcheck on scripts
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # 2.3.4
+
+      - name: Run shellcheck
+        uses: ludeeus/action-shellcheck@94e0aab03ca135d11a35e5bfc14e6746dc56e7e9 # 1.1.0
diff --git a/Dockerfile b/Dockerfile
index 5be89ed..9800af6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,37 @@
-ARG REPO=nimlang/nim
-ARG IMAGE=1.4.4-alpine-slim@sha256:5c82efe7f3afffe4781f3f127d28c21ecb705dc964cc5434fee98feafd63d2d7
-FROM ${REPO}:${IMAGE} AS builder
+ARG REPO=alpine
+ARG IMAGE=3.13.5@sha256:def822f9851ca422481ec6fee59a9966f12b351c62ccb9aca841526ffaa9f748
+FROM ${REPO}:${IMAGE} AS base
+# We can't reliably pin the package versions on Alpine, so we ignore the linter warning.
+# See https://gitlab.alpinelinux.org/alpine/abuild/-/issues/9996
+# hadolint ignore=DL3018
+RUN apk add --no-cache \
+      gcc \
+      musl-dev
+
+FROM base AS nim_builder
+COPY bin/install_nim.sh /build/
+# hadolint ignore=DL3018
+RUN apk add --no-cache --virtual=.build-deps \
+      curl \
+      tar \
+      xz \
+    && sh /build/install_nim.sh \
+    && apk del .build-deps
+
+FROM base AS runner_builder
+COPY --from=nim_builder /nim/ /nim/
 COPY src/runner.nim /build/
 COPY src/unittest_json.nim /build/
-RUN nim c -d:release -d:lto -d:strip /build/runner.nim
+RUN /nim/bin/nim c -d:release -d:lto -d:strip /build/runner.nim
 
-FROM ${REPO}:${IMAGE}
-# We can't reliably pin the `pcre` version here, so we ignore the linter warning.
-# See https://gitlab.alpinelinux.org/alpine/abuild/-/issues/9996
+FROM base
+COPY --from=nim_builder /nim/ /nim/
 # hadolint ignore=DL3018
-RUN apk add --no-cache pcre
+RUN apk add --no-cache \
+      pcre \
+    && ln -s /nim/bin/nim /usr/local/bin/nim
 WORKDIR /opt/test-runner/
-COPY --from=builder /build/runner bin/
+COPY --from=runner_builder /build/runner bin/
 COPY bin/run.sh bin/
 COPY src/unittest_json.nim src/
 ENTRYPOINT ["/opt/test-runner/bin/run.sh"]
diff --git a/bin/install_nim.sh b/bin/install_nim.sh
new file mode 100755
index 0000000..6103c98
--- /dev/null
+++ b/bin/install_nim.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -ex
+
+readonly ARCHIVE_FILENAME='nim.tar.xz'
+readonly NIM_VERSION='1.4.4'
+readonly BUILD_DIR='/build/nim'
+readonly INSTALL_DIR='/nim/'
+mkdir -p "${BUILD_DIR}"
+
+(
+  cd "${BUILD_DIR}" || exit
+  curl -sSfL -o "${ARCHIVE_FILENAME}" "https://nim-lang.org/download/nim-${NIM_VERSION}.tar.xz"
+  tar --strip-components=1 -xf "${ARCHIVE_FILENAME}"
+  sh build.sh
+  rm -r c_code "${ARCHIVE_FILENAME}"
+
+  bin/nim c --skipUserCfg --skipParentCfg koch.nim
+  ./koch boot -d:release -d:leanCompiler
+
+  mkdir -p "${INSTALL_DIR}"
+  mv bin config lib "${INSTALL_DIR}"
+)
+
+rm -r "${BUILD_DIR}"